Splunk App for Splunk offers an option to visualize Wazuh Alerts and API data. Wazuh helps you to gain deeper security visibility into your infrastructure by monitoring hosts at an operating system and application level.
manager receiving
. (Check bottom).wazuh
.On Splunk, Go to Settings
--> Data Inputs
and edit the four new local inputs with prefix wazuh*
one by one (Remember to use your API URL and API credentials).
api_server
section.username
, password
, Wazuh Manager IP + API HTTP PORT
.More settings
.wazuh_api
Repeat the process on each Data input (four in total).
Wait a couple of minutes to have data in your wazuh_api
index.
$SPLUNK_HOME/etc/system/local
. Edit the file inputs.conf:
[monitor:///var/ossec/logs/alerts/alerts.json]
disabled = 0
host = wazuhmanager
index = wazuh
sourcetype = wazuh
host = wazuhmanager
, hostname of Wazuh Manager.index = wazuh
, index by default to store alerts.sourcetype = wazuh
sourcetype by default to alerts received.Edit the file and add the following stanza on props.conf:
[wazuh]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = none
NO_BINARY_CHECK = true
category = Application
disabled = false
pulldown_type = true
Point the output to the Wazuh's Indexer (or indexers):
$SPLUNK_HOME/bin/splunk add forward-server <host name or ip address>:<listening port>
host name or IP address
IP address of Splunk Indexerlistening port
By default on port 9997
.Splunk username/password
are: admin/changeme
at forwarder level. Restart Splunk services (Windows Service, Linux).
Test on Splunk:
index=wazuh *
Click Save. Splunk software starts listening for incoming data on the port you specified.
More info at Splunk Documentation